Posted
by
timothy
on Saturday August 25, 2012 @05:47PM
from the wall-of-separation dept.

An anonymous reader writes "Microsoft has denied Windows 8 SmartScreen is spying after research by Nadim Kobeissiindicated otherwise." Whether it's "spying" or not, Microsoft is collecting certain information with SmartScreen — the key is what's done with it: The article quotes a Microsoft spokesperson: "We don’t use this data to identify, contact or target advertising to our users and we don’t share it with third parties."

Just read the Ars Technica article. [arstechnica.com] The Slashdot headline is ridiculously slanted, as was the previous story.

While I disagree with it in principle - I'd rather it be local, like how Firefox uses a local version of the bad-sites list, this is not in any way unusual or awful behavior, and it's mostly a good idea, and Microsoft has been completely open about how and why they're doing this and giving you an easy way to turn it off. It is not some privacy invading nightmare. Microsoft is not keeping track of what programs you download (unless, obviously, you get them through the Microsoft store.)

Slashdot stories are becoming more and more ridiculous. The summaries are never even worth reading anymore.

There are a whole load of "suddenly technically knowlagable" people dissembling here (I'd hate to say shills; but somewhere someone is feeding in disinformation).

the application sends checksums to Microsoft

those checksums correspond one to one to applications

Microsoft will normally know which application is which

that information will be discoverable by the Police / authorities etc.

the application is no by default and does not ensure the user knows how it functions.

Now let's have a look at some of the language being used in the Ars Technica article.

This would allow the company to make some estimates of which IP addresses were running which software.

"some estimates" implies that there wold be uncertainty; that Microsoft wouldn't be able to say 100% that you were using a piece of software. Maybe it is Tor; maybe it's actually Tornado the game. The implication is a humal level of uncertainty which just doesn't apply.

"which IP addresses" implies that Microsoft would not know who you are. This shows an even greater level of deception. It's even trying to imply that your information may not be linked, if, for example, you change IP addresses. Microsoft has your software registration. Microsoft knows about your usage of Bing. Microsoft has your passport account. If any company other than Google can link your IP address to a particular person; that company is Microsoft.

Compared to this Ars Technica article, Slashdot is a haven of technical superiority and higher journalistic ethics and integrity. Maybe Anonymous Coward could set up a journalism course for the guys at Ars Technica.

Finally let's look at Microsoft's statement in the article (N.B. we don't get told what question this is an answer to; note that it might potentially be Microsoft answering to a question about their web sites in which case Ars Technica is again doing the deception; let's take it at face value however).

We can confirm that we are not building a historical database of program and user IP data. Like all online services, IP addresses are necessary to connect to our service, but we periodically delete them from our logs.

The entire point of this service is to build up a "historical" database of executables. It works by identifying those downloads which are known and safe by how often they are downloaded and builds up a "reputation". Ars Technica describes this as "anonymised" without going into details. If you think that they don't at least have the IP network address then I have a bridge to sell you. Let me explain a simple exploit for you: before releasing your malware, repeatedly download it on each of your computers Microsoft will sign it as as having a good reputation. Microsoft's only possible defence against this is to ensure that it knows, at least to some level, which IP addresses used which software.

Yet no one cares that Firefox and Google do exactly the same thing, plus that they do it with a unique key for every Firefox install. That key allows Google to identify a firefox session, even when it's "In Private"

If you block the connection to Google's Safe Browsing service at either the firewall or proxy server, then the firefox installs silently fail. You Must disable the check in about:config (safe) to do so and there are six entries and every one has to be reset to off otherwise safe browsing is not

If you block the connection to Google's Safe Browsing service at either the firewall or proxy server, then the firefox installs silently fail. You Must disable the check in about:config (safe) to do so and there are six entries and every one has to be reset to off otherwise safe browsing is not disabled.

Interesting....do you by chance have any links to instructions on how to disable all of this in FF?

Nope. I'd rather have a local database, even though I assume that's more difficult to keep up-to-date with what I imagine are rapidly changing blacklists. Firefox, for example does this.

But this behavior is (unfortunately) pretty bog standard, and in the case of IE, it's nothing new, so it seems a little bizarre to get all outraged about it now when all Microsoft has added is a check on file download hashes.

The article quotes a Microsoft spokesperson as saying: "We don’t use this data to identify, contact or target advertising to our users and we don’t share it with third parties."

Now, if they had said "don't and won't", then that would mean something. Just saying "don't" means they don't do it today with no guarantee about what they might do with all that data at some future date. Color me unimpressed.

A quibbler might also note that the spokesperson only mentioned the data itself, not results extracted from it. Color me unimpressed yet again.

"Look in his history: His Karma is negative. The comment hasn't even been modded."

Don't believe the history of zenlessyank, or anyone else. At least in my case, every comment score is wrong, on the low side. How's yours? The history function should be fixed or removed- it's been broken far too long.

OTOH, zenlessyank is remarkably fond of exclamations--used in most titles. Those exclamations tend to be rants, many with a religious undercurrent. Zenlessyank is not given to subtlety which may have something to

Mine is pretty accurate, considering I have a +2 Karma bonus, so I don't need many pluses to get a 5, and usually get 15 mod points at a time, with a rare 5 from time to time.

zenlessyank's history is not informative based on the scores, because negative karma grants you anywhere from +2 to -1 automatically. It doesn't matter what a post score is. Just read the comments. I find history invaluable when moderating, because it can help when I can't determine when someone is sarcastic or genuinely idiotic.

And if you get it pre-installed there is a checkbox in Action center that kills it, which if you are so clueless that you can't even uncheck a checkbox in a GUI? Really having a hard time feeling sorry for you.

Besides frankly the whole subject is moot anyway, you are talking about an OS that gets articles like Windows 8...yes its THAT bad [infoworld.com] and is the subject of parody before its even released [youtube.com] so I kinda doubt its gonna be seeing much use on anything but tablets. Hell the only reason it'll be seeing ANY use o

And if you get it pre-installed there is a checkbox in Action center that kills it, which if you are so clueless that you can't even uncheck a checkbox in a GUI? Really having a hard time feeling sorry for you.

Normally I would agree with you, but having done a whole lot of Windows support over the years? There are way too many people out there (I daresay a majority among the consumers) who doesn't even know what an Action Center is, or what the smartscreen feature really does, let alone know to go there and uncheck the box. To top it off, odds are good (disclosure, I haven't looked) that disabling the feature will come with a pop-up window warning dire consequences if the user goes through with opting-out. (simil

Dude, I've been building, repairing, and selling Windows machines since 1993, so I know of which I speak, and those people? Those are MY CUSTOMERS and I happily turn off any cycle sucking bullshit, just as I turn off all the extra "bling bling" animations in Windows. You'd be surprised how many compliments of "Wow, I don't know what you did, but its sure fast and snappy now!" when all I did was kill all the cycle sucking horseshit.

So don't worry friend, because people THAT clueless? Come to me soon enough

The check box appears on first account setup, so any use buying a new PC will see it too.

The choice should be Opt-in, rather than Opt-out. This is just like their old "everything is enabled" features. It's not hard to have a screen pop up asking you if you want this info reported to Microsoft. Then you say "Yes or no. Then if you are okay, click on that yes, if not, nothing happens.

Yes, it appears as a check-box (or equivalent), labeled "SmartScreen".

No, it does not. The exact text next to the checkbox is: "Use Windows Smartscreen Filter to Check Files and Apps with Microsoft." This is a very brief yet clear description of what the feature is and that you will indeed be checking in with Microsoft with respect to files and apps.

Especially when you are setting up your computer and can't just search for what it means because the desktop is not yet available?

Clearly you don't know what you're talking about. Have you ever actually installed Windows 8? There are two links right there in the overview screen for Express Settings. One goes into detail what each setting is for and what it d

Ah, yes. I see now that you were simply pointing out that some people claim that it doesn't do anything. Because I have heard this claim before, I thought you were one of those folks. I stated it works in many cases, rather than all, because it is certainly true that there has to be at least one elevator where the damn button is broken even if there is no such thing as an elevator that ignores it by design.

Around here the crosswalk buttons are at least hooked up and responsive. I will get a walk signal if and only if I press the button, otherwise the traffic lights change but the don't walk signal stays lit. I do still doubt that they affect the timing of the lights, but they are connected to something.

Not only do they allow you to turn it off during install, they provide a detailed explanation of what the feature does, what data they collect, how they use the data, and how you can turn the feature off during install and after install. This seems to be just about all the information a user needs to make an informed decision about whether or not to leave smart screen on. if the user opts not to read this information and clicks right through the express settings without caring about the consequences, perhaps that's exactly the kind of user this smart screen filter aims to protect; odds are they have the same lackadaisical attitude when install Ing random software from the internet. Its self selecting really.

Only because the term "tin foil hat" when used to express contempt for those who contort reality is actually and properly an "aluminum foil hat" (or aluminium if you insist), I call you a hypocrite. There is enough even in the sacred arstechnica version of this story to warrant liberal paranoia. Why not save the tin-card for a better occasion, like one where someone is denying a tangible and verified reality and not just making a simple mistake?

People stupid enough to not disable it are the type that also install MyWebSearch and Freeze and Maps Galaxy and I'd name more but I probably already set off your protection program with this post lol. So that actually fits perfectly, as it sounds like it may warn people about rogue co-installers on "free" games and registry utilities and crap.

And you actually believe that checking the "Disable it" box will disable this facility? Or that it will not be re-enabled with just about any update?

This, unfortunately, is where the disadvantage of closed-source strikes: you cannot really verify that a device serves you instead of someone else. As soon as you install a binary, or a patch, you hand over control of your device to whoever wrote the code. We all know that. You basically need to trust the one pushing the patches to you.

FFS, where do these retards come from, read the damn article or better still read a non tin foil hat version from somewhere like Ars Technica. It is purely an anti malware prevention system that checks if the hash is a known malware when you go to install. There is a lot to hate windows 8 about, but this is actually one of the beneficial features that should help everyone, from the dumb users that install malware to the rest of us that get spammed by the botnets created by that malware.

I'd rather it be done locally as well. I suppose the reason it's done remotely is so the blacklist can be updated and maintained on the server side. That's a perfectly good reason - Chrome sends all your URLs to check against a server-side blacklist as well - and it is probably better from the security standpoint.

Long-term, though, I think the remote check opens up a potential for vector for invading privacy in the future, which I'd rather not have.

Because then the malware will simply target this just like they do other Windows components? The problem with doing it on the local machine is 1.-The malware guys will know exactly where it is, and 2.- The dancing bunnies problem [codinghorror.com] where the malware writer tricks the user into bypassing the check by offering the right cookie, thus compromising the entire system and allowing the malware writer full control.

By hosting it remotely you've just bypassed both problems as the servers running this at MSFT is gonna be better protected than grandma's Dell is, and there isn't any users to trick with dancing bunnies to bypass the system. I work on Windows PCs 6 days a week and I can tell you that frankly since Vista drivebys and buffer overflows have gone WAAAY down, now its nearly all social engineering like Security Tool, "free porn" codecs, or getting the user to run some "free" program and bypass the checks, why? Because like all criminals malware writers are lazy creatures and will take the path of least resistance and that is PEBKAC in most cases.

Because then the malware will simply target this just like they do other Windows components?

What makes you think service cannot be targeted just because the list of hashes is stored remotely? The service still has create the hash locally and query the remote hash list. This service would be as effective if the hash list is local.

Because if it can't make the hash or its own files don't check it'll probably have a screaming shitfit and let the user know something is up? Look I'm no Windows 8 fan, in fact I'm quite happy that all my customers, as well as my family, are sticking with Win 7. I'll be picking me up one of those $40 Pro deals just to learn the tricks but I sure as hell ain't dealing with metro day to day, just running the CP for a month at the shop made me want to pull an Elvis on the screen.

If a hacker can modify its files, he can easily make it to not submit the hash at all (or always submit a different hash for a specific set of hashes). Unless you have hardware support (like trusted computing device), you have no way of verifying your own program has been modified. If the hacker cannot change any of your files, he cannot change your local hash list file either. So I dont see the benefit of having the hashes remotely.My question still is why do they opt to do this. If I submit a comp

Well that, and you entered into an arrangement with MS when you chose to install their operating system, whatever you may think of that arrangement, microsoft kinda needs to know what you're doing on the computer to know what's causing problems, because lets face it there are a lot of copies of windows in the world an even rare errors can cause huge chaos.

That doesn't mean you can't (or shouldn't) opt out of anything you're not comfortable with, but if you want stuff to work microsoft needs to know what's b

Should Linux repositories, the Apple App Store, the Google Store, and the Microsoft store provide a similar warning, since they actually glean more information from what you download there?

I mean, all Microsoft gets from this is a filename and a hash. Unless Microsoft has a hash of every program in existence, that doesn't do them much good for spying purposes. On the other hand, they know everything about the app you're downloading from their store.

"Should Linux repositories... provide a similar warning, since they actually glean more information from what you download there?"

When I download a binary from another location or build from source Linux distributions don't report that to a corporation. If Microsoft had a repository then that would be different. They don't. You would have to be a moron not to know that, in those other scenarios, they know your IP and what you are installing.

You just don't want to get it. Installing software that reports what you install outside of the company's install channel is the issue. There is no way to install software inside a given install channel without knowing the IP address and software title. They are two completely different scenarios. Stop comparing them and acting like they are similar.

What the hell do you think a hash is? Learn about them and then you will see why your statement is absurd. Maybe. How do you think the blacklist works if the hash doesn't uniquely identify the file? Just give it up. You don't have a clue what you are talking about. That in and of itself is not bad, but acting as though you do is absurd.

A hash doesn't identify an executable unless you have a list of the hashes of every executable rather than just a blacklist of malware hashes.

And again, this applies only to files downloaded with IE.

And again, the logs are wiped on a regular basis.

Even ignoring all this, you've yet to explain why it is the common man understands perfectly the ramifications of downloaded from an app store, but not that of SmartScreen. Especially when SmartScreen's potential problems are explained.

Searching the repo is not "reporting back", and it's a bug not something designed in to the system intentionally. Furthermore, we already addressed the fact that you cannot install or download from a source without them knowing the name of the file to download and where to send it. Finally, there are many, many mirrors so unless you use Redhat's mirrors they actually don't know you installed anything.

When the system sends a notification to Redhat that you have installed something that you did not grab fr

Yep.. when you get a new 'droid, iPhone or iPad, all of your apps automatically reinstall...wonder how that happens. Just because it's Microsoft this is an issue. Actually SmartScreen on Windows 8 is a good way to see what my kid is doing on the Internet without some 3rd party crapware that is definitely using your shit in ways you don't know about. And as other posters have said you can just turn it off.

Because that would be the equivalent analogy. SmartScreen sends URLs and file hashes to Microsoft, the exact same way Google's anti-malware sends URLs to Google to compare against a blacklist.

And besides, that, Google "collects" information about what you download through their store, in the same sense - you can't download the app without them knowing your IP, which is the same information Microsoft is getting. If you really cared about this kind of privac

-you opt to install/use chrome, it doesn't come standard. I presume people read the EULA if they install software! Same goes for Firefox BTW.-Google collects info on what you download from the Google store. Flip the checkbox to install from other sources, Google doesn't get that info. So not exactly the same as all downloads are send to OS manufacturer.

It's equally as simple. Probably simpler - never used an Android phone. Both are opt-out from your description, and the SmartScreen functionality seems to be outright presented as an option on installation.

I am also pretty sure that Chrome does, in fact, come standard on Chrome OS and I assume that the default web browser on Androids is Chrome or some variant thereof that sends your URLs to Google same as Chrome does.

I think it's more like the Play Store knows what you have/had installed and will automatically re-install this. After all they do keep track of what you have installed. Backing up data is, afaik, just data: your own data. Not the apps themselves.

No direct experience with that reinstall part myself, still on my first Android.

I see/. is in for another round of anti-Windows 8 sensationalism. Please read the Ars Technica article [arstechnica.com] talking about this before commentating.

Ah, sweet irony. Your Ars Technica article links to a wired article that argues cryptocat is no more secure than using no crypto at all, because it relies on host security, and then proceeds to defend Smart Screen using a host-security argument.

If you don't care Microsoft gets access to which programs you run / trust that they will keep the data anonymized and periodically delete the logs as you claim, by all means, don't turn off Smart Screen. That said, they have all the data they need to keep a record if every program you run, and I'd rather not take them at their word that they won't do anything bad with it.

In other news Apple collects information for every app users install on their iPhones. So will MS on WinRT tablets and Win 8 Metro environment. In a world like this only an idiot can point a finger in a security service that uses hashes and can be turned off.

I was wondering how long it would take before somebody brought up Cryptocat, and whether the person doing so would have a clue or not. Looks like the answers are "not long" and "no".

The goal of SmartScreen is to warn the user against running malicious software. The goal of Cryptocat is to make a user's chat session completely untappable. Not only are these two goals quite different, but most of the weaknesses of Cryptocat are based on an environment that SmartScreen simply doesn't have. Also, it's not "no m

I wasn't arguing for the security of cryptocat. I hadn't even heard of it before I saw the article. I was merely commenting on the irony that the same (in my opinion, very valid arguments) against cryptocat in the wired article linked in the Ars Technica article would also apply to Smart Screen.

Also, it's not "no more secure than using no crypto at all"

Right, I doubt that would be the case too, but from the article I'm talking about, "More generally, your security in a host-based encryption system is no better than having no crypto at all."

TFA just says they aren't doing anything with the information... for now. That doesn't mean the FBI or whatever 3 letter agency can't put a shunt between the Internet and their SmartScreen servers. It's a sniffing vector.

A fair point, no doubt; but the word "deny" in Microsoft-context carries pretty strong connotations of incredulity. I think the title simply serves as a sort of aperitif, which worked well enough for me. In other words, Microsoft can deny whatever it wants and (knock on wood) people will still proceed to think.

So what? If the feds want to know what you're downloading and such, it's a hell of a lot easier to go through your ISP. Smartscreen as a sniffing vector is technically true but completely irrelevant to the difficulty of the attack you propose.

That confuses me slightly. I have vague recollections of using my computer while away from home. And if laptops are actually becoming more popular than desktops, I fear I may become more confused. Naive as I am though, I'd probably even say that laptops are already more popular than desktops, and 'mobility' seems to be one their most marketable features. Now if I changed my MAC address before connecting to another random ISP, how would they identify me? Maybe you are like me in assuming ISPs like Verizon h

That screen is telling you that Microsoft is protecting your privacy. Perhaps sending the IP of every site you visit and every file you download is protecting your privacy? Doubleplusgood!

Oh, wait. You send the "Do not Track" button. With all due respect, I suspect that once you hit the do not track button, your IP addresses, history and downloads will be considered much more interesting to people who might find them interesting because you asked them not to track you.

Apple knows not only what applications you have, when you use them, how many times you use them, but where you are down to a resolution of 10m anywhere on the planet you are, at anytime.doesnt matter if you are a politician, gangster or regular joe

and you are worried about Microsoft ? lol

bottom line is:do you trust an "American" multi national company with your personal data ?

Of course Microsoft is spying. They have admitted that they are receiving the data they were accused of receiving. At best they're saying that they won't use the data for advertising purposes.

If they wanted to do this without spying, they could load the signatures of the top 10,000 known-good executables into a file sent out with Windows Update. Those wouldn't need to be checked. Only when some unknown executable showed up would a remote check be necessary.

"We don't use this data to identify, contact or target advertising to our users and we don't share it with third parties."

There are certain grammatical rules in BusinessSpeak which should be kept in mind. For example, in proper BusinessSpeak, the phrase "At this time" which goes before "we" in the preceding quotation is silent.